Security Advisory 2022-10-04-1 - wolfSSL buffer overflow during a TLS 1.3 handshake (CVE-2022-39173)

Release and security announcements
21

You look like me:

BusyBox v1.35.0 (2022-09-03 02:55:34 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 22.03.0, r19685-512e76967f
 -----------------------------------------------------
root@Dachshund:~# opkg list-installed | grep wolfssl
libustream-wolfssl20201210 - 2022-01-16-868fd881-2
libwolfssl5.5.1.ee39414e - 5.5.1-stable-3
px5g-wolfssl - 5.1
wpad-basic-wolfssl - 2022-01-16-cff80b4f-13.1
root@Dachshund:~#
22

No, you shouldn't be worried.
If you don't expose any service to the internet you can safely wait for the next version that will likely have the fix

23

It’s a long time ago but wasn’t 19.07 based on mbedTLS or OpenSSL instead of WolfSSL?
WolfSSL as standard came with 21.02 if remember right.

24

Had the same problem as @Bill, my wifi client mode didn't work anymore. (I assume it uses wolfSSL) After I removed the dependency package it worked again.

After this dependency fix I had no dns resolving anymore. I did use https-dns-proxy, but after this 'upgrade' it will not start the service and it doesn't change the settings in dhcp and dns back to default if it's not starting.

I'm using OpenWrt 21.02.3 on a respbarry pi 4b

Found https://github.com/openwrt/packages/issues/19547
I'm not alone I see. :wink:

1 Like
25

@ray308 Did you get it fixed?

Summay_Old

I didn't say I had a problem, I just had an collected error. That resolved itself once I upgraded the other two packages.
rhester states that following certain steps prevents the collected errors.

Yet to your problem concerning wifi I can not chime in as my router's wifi is not enabled.

^^ is being addressed.
https://github.com/openwrt/packages/pull/19548

26

Yes it's fixed. As in the github threat.

27

19.07 didn't come with any such crypto library by default. No HTTPS LuCI, no WPA3, and no connecting to HTTPS servers without installing extra packages.

28

Upgraded all updates packages* on my TP-Link Archer C2600 and two A7 v5 devices running 22.03.

root@ap2:~# opkg update
root@ap2:~# opkg list-upgradable
root@ap2:~# opkg upgrade luci-app-opkg luci-mod-system libustream-wolfssl20201210 wpad-basic-wolfssl px5g-wolfssl hostapd-common wireless-regdb
root@ap2:~# /etc/init.d/uhttpd restart
root@ap2:~# opkg list-installed | fgrep wolfssl
libustream-wolfssl20201210 - 2022-01-16-868fd881-2
libwolfssl5.5.1.ee39414e - 5.5.1-stable-3
px5g-wolfssl - 5.1
wpad-basic-wolfssl - 2022-01-16-cff80b4f-13.1

So far all appear to be accessible and operating normally.

*[I remain aware that this is not recommended, but still do so regularly with no adverse impact since one incident many versions ago.]

29

wpa2 is also a crypto solution, actually very similar to wpa3, and I assume a lot of users installed some of the luci-ssl variants anyway.

https://openwrt.org/releases/19.07/notes-19.07.0?s%5B%5D=wpa3
And WPA3 was introduced on 19.07 also because I myself tried to get it working on the wrt3200acm.

30

For all three of the things I mentioned, I was talking about out-of-the-box support, as I said. 19.07 required installing additional packages, because it did not ship with wolfSSL, mbedTLS, or OpenSSL by default. WPA2 does not require any of those libraries.

Point being, 19.07 and earlier are not vulnerable to this issue unless the user made a deliberate effort to install wolfSSL.

31

Another point in favor of hardening OpenWRT. There should be instructions in there (but aren't) about how to disable Luci when not needed. A quick ssh can re enable whenever admin is needed. Threat model for wireless administration

root@OpenWrt:~# opkg list-installed | grep wolfssl
libustream-wolfssl20201210 - 2022-01-16-868fd881-2
**libwolfssl5.2.0.99a5b54a - 5.2.0-stable-1** #vulnerable
libwolfssl5.5.1.99a5b54a - 5.5.1-stable-2
px5g-wolfssl - 3
wpad-basic-wolfssl - 2020-06-08-5a8b3662-40

opkg update; opkg upgrade libwolfssl libustream-wolfssl

opkg upgrade px5g-wolfssl wpad-basic-wolfssl


root@OpenWrt:~# opkg list-installed | grep wolfssl
libustream-wolfssl20201210 - 2022-01-16-868fd881-2
libwolfssl5.5.1.99a5b54a - 5.5.1-stable-2
px5g-wolfssl - 4.1
wpad-basic-wolfssl - 2020-06-08-5a8b3662-41

reboot

Looks fine now. You could combine the commands but I am following KISS.

32

22.03.1 and 21.02.4 will be released soon

2 Likes
34

Hi, i just upgraded for 21.x to 22.x and i have the same your versions installed. Have you tested / used https-dns-proxy if it work now? Thanks

1 Like
35

Thanks. Installed.
Using BanIP, so sticking with 21 releases. :slight_smile: